docs: consume factory sender custody and retain delivery gate

Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a07ff8-19d0-7820-b4d0-1353833cb7fc
2026-09-11 10:09:10 +02:00 · 2026-09-11 10:09:10 +02:00 · 7471d3835f
commit 7471d3835f
parent b154f4d497
3 changed files with 103 additions and 0 deletions
--- a/docs/evidence/2026-09-11-factory-audit-delivery-login.json
+++ b/docs/evidence/2026-09-11-factory-audit-delivery-login.json
@ -0,0 +1,20 @@
+{
+  "schema": "platform.factory-audit-delivery-attempt.v1",
+  "observed_at": "2026-09-11T08:06:20.638931+00:00",
+  "status": "login_failed_before_delivery_handoff",
+  "wrapper_exit": 5,
+  "delivery_receipt_created": false,
+  "delivery_command_executed": false,
+  "credential_values_emitted": false,
+  "remote_session_revocation": "unconfirmed_for_this_failed_login",
+  "permanent_custody": "preserved_version_1_registry_version_8",
+  "next_step": "Fresh attended delivery after browser/login feedback; do not seed or rotate again",
+  "validation": {
+    "delivery_contract_tests": 7,
+    "custody_tests": 18,
+    "custody_tests_using_real_local_openbao": 11
+  },
+  "platform_delivery_source": "44314cad3704bda40683383f898b55b1f41491bc",
+  "factory_attempts": 0,
+  "paid_calls": 0
+}
--- a/docs/evidence/2026-09-11-factory-audit-sender-seed.json
+++ b/docs/evidence/2026-09-11-factory-audit-sender-seed.json
@ -0,0 +1,63 @@
+{
+  "schema": "platform.factory-audit-custody.v1",
+  "status": "custody_seeded_pending_delivery_and_receiver_reload",
+  "credential_values_emitted": false,
+  "started_at": "2026-09-11T05:37:49.432171+00:00",
+  "lanes": [
+    {
+      "ccr": "CCR-2026-0021",
+      "name": "approval-engine",
+      "kv": "platform/data/workloads/approval-engine/audit-sender",
+      "store": "openbao-approval-engine-audit",
+      "secret": "approval-engine-audit",
+      "secret_key": "audit-token",
+      "source_sha256": "ba69ecc8227c5bf887c2cd0ac4c50518c019bebfdfb6d49628edee1ce570da7d"
+    },
+    {
+      "ccr": "CCR-2026-0022",
+      "name": "informed-decision",
+      "kv": "platform/data/workloads/informed-decision/audit-sender",
+      "store": "openbao-informed-decision-audit",
+      "secret": "informed-decision-audit",
+      "secret_key": "token",
+      "source_sha256": "2f7f7f214d1e21fd79275197edd03ee7e154ef451d62a182017926250515a6aa"
+    }
+  ],
+  "receiver": {
+    "image": "forgejo.coulomb.social/coulomb/audit-core@sha256:c82e0442de0fd181342916ae9cd5d6de41d859e1efda637bd93936c67873afa5",
+    "deployment_uid": "b85fe3d0-75c9-4e0d-8c34-c6f1df0881bb",
+    "deployment_resource_version": "59751057",
+    "pod_uid": "6642c414-a942-4b11-b048-267423e12da8",
+    "capabilities": {
+      "load_bearing": true,
+      "redact": true,
+      "write_only": true,
+      "source_exact": true,
+      "tenant_exact": true
+    },
+    "synthetic_probe_only": true,
+    "credential_reads": 0
+  },
+  "phase": "registry_cas",
+  "registry_version_before": 7,
+  "seeded": [
+    {
+      "ccr": "CCR-2026-0021",
+      "version": 1,
+      "request_id": "cf6dd167-9d37-fbcf-cc3d-6d54c0f988b9"
+    },
+    {
+      "ccr": "CCR-2026-0022",
+      "version": 1,
+      "request_id": "2f373e63-058b-7a6e-07c4-365317dffa73"
+    }
+  ],
+  "registry_write_request_id": "91fdb393-80ba-4e06-2dde-3982763d0ae5",
+  "registry_version_after": 8,
+  "unchanged_other_senders": true,
+  "unchanged_other_registry_fields": true,
+  "credentials_reused": false,
+  "attended_wrapper_exit": 0,
+  "attended_session_self_revocation": "confirmed_by_successful_wrapper",
+  "prior_failed_login": "not asserted resolved by this new session"
+}